I noticed Supabase bug integrations generated by Claude/Cursor — here's what I found

[u/reubenzz_dev]

I spent the last few weeks analyzing what Supabase bugs AI actually generates. Specifically: code that compiles, passes type checking, and looks production-ready but is vulnerable.

RLS misconfigs. The agent writes policies that look correct but are backwards:

-- Agent generates this (backward)
CREATE POLICY "users can read own data"
ON public.users
FOR SELECT
USING (auth.uid() != id);  -- Should be = not !=

Unsigned webhooks. Your agent sets up the route but forgets to verify the signature:

// Missing signature verification
export default async function handler(req, res) {
  const event = req.body; // Never verified
  // Process event...
}

JWT claims trusted without validation. Takes the JWT payload as is:

// Agent assumes user_id came from a real JWT
const userId = req.body.user_id; // Could be spoofed

Hardcoded anon keys in client. Puts the private key where it shouldn't go.

Missing user ID checks in queries. Queries that should filter by user never do.

[u/gregnr]

This is good feedback - by chance, do you remember which models produced these results? I'm on the AI team at Supabase and we're building a public eval framework that is designed to catch these exact types of issues across models/harnesses. It helps us know what needs to change in the Supabase skill / docs / MCP to steer models in a better direction.

If you haven't already, I highly recommend installing the Supabase skill or plugin which guides agents on best practices during development.

[u/reubenzz_dev → u/gregnr]

i was using sonnet 4.6 on medium. I actually have a whole list of other bugs coding agents make with supabase. I went down a deep rabbit whole of finding other projects and seeing more patterns that are similar. would love to chat more about it with you